CVE-2026-15955 IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-15955

IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.5 (Client editions on Linux and Unix ; Windows unaffected) are vulnerable to arbitrary file write via the IBM Data Server driver for JDBC and SQLJ . The root cause is improper validation of file paths (CWE-22 / Path Traversal), allowing a malicious D...

CVE-2026-15955 IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-16338 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-16338 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

EUVD-2026-77797

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ could allow an evil server to perform an arbitrary file write on the connected client due to improper validation of file paths (CVE-2026-15955)

Summary IBM® Data Server driver for JDBC and SQLJ could allow an evil Db2 server to perform an arbitrary file write on the connected client due to improper validation of file paths. This vulnerability also applies to Db2 due to bundled JDBC and SQLJ components. Vulnerability Details...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to version 1.16.4, the caching mechanism for ld.so removed outdated cache files without properly checking whether the app’s control over the path to the outdated cache was valid within the cache directory. This allowed...

CVE-2026-84609: Buffer Copy without Checking Size of Input

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files...

PT-2026-91452

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

PT-2026-91648

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

CVE-2026-65382: Improper Limitation of a Pathname to a Restricted Directory

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

CVE-2026-86902: Improper Limitation of a Pathname to a Restricted Directory

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...

PT-2026-91655

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files...

PT-2026-91543

Name of the Vulnerable Software and Affected Versions macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 Description A parsing issue exists in the handling of directory paths due to insufficient path validation. This flaw could allow an...

CVE-2026-84609: Buffer Copy without Checking Size of Input

A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files...

PT-2026-91625

Name of the Vulnerable Software and Affected Versions macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 Description A path traversal issue exists where an attacker controlling a network directory server can bypass path validation to...

PT-2026-91706

Name of the Vulnerable Software and Affected Versions macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 Description A permissions issue exists where an application may be able to access restricted files due to insufficient path...

CVE-2026-65382: Improper Limitation of a Pathname to a Restricted Directory

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

Important: samba

Issue Overview: A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for syst...